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Abstract. We deal with the distribution of N points placed consecu- 
tively around the circle by a fixed angle of a. From the proof of Tony 
van Ravenstein [RAV88 , we propose a detailed proof of the Steinhaus 
conjecture whose result is the following: the N points partition the circle 
into gaps of at most three different lengths. 

We study the mathematical notions required for the proof of this theorem 
revealed during a formal proof carried out in Coq. 



Introduction 

Originally, the three gap theorem was the conjecture of H. Steinhaus. Sub- 
sequentl y , several proofs w ere proposed by |S()S57| |S()S58| |SWi58| |SUR58) 
HA L65j |SLA67| |RAV 88 . The proof proposed in this paper is a presentation 
of the proof completely fomalized in the Coq proof asssistance system |MAY99| . 
This formal proof is based on Tony van Ravenstein's |RAV88| . 

This kind of demostration, which involves geometrical intuition, is a real chal- 
lenge for proof assistance systems. That is what motivated our work. Therefore, 
the interest of such an approach is to understand, by means of an example, if 
the Coq system allows us to prove a theorem coming from pure mathematics. 
In addition, this development allowed us to clarify some points of the proof and 
has led to a more detailed proof. 

First, we will define the notations and definitions used for stating and proving 
this theorem. The second part deals with different states of the theorem and 
with the proof itself. Finally, the last part presents advantages of the formal 
proof stating the main differences between our proof and Tony van Ravenstein's 
proof. 



1 Notations and definitions 

1.1 Notations 

We can refer to figure ^ 
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Fig. 1. The three gap theorem 



— DM is the natural numbers set. 

— R is the real numbers set. 

— The integer part of a real number r is noted E(r). 

— The fractional part of a real number r, ie r — E(r) 1 is written {r}. 

— The first point on the circle is the point 0. 

— Unless explicitly mentioned, we consider TV points distributed around the 
circle. These are numbered from to N — 1. 

— We consider the circle of unit circumference and with a clockwise orien- 
tation. 

— a is counted in turns of the circle (and not in radian); then < a < 1. 

— The first point if N >1) on the right of is written first(N). first(N) 
is a function from the natural numbers to the natural numbers. 

— The last point if TV >1) before is written last(N). last(N) is a function 
from the natural numbers to the natural numbers. 

— n 6 Circle is equivalent to < n < N. 



Remark 1. The distance from point to point n is {n.a}. 



1.2 Definitions 

The following definitions are valid for all a, rational or irrational. 

Lemma 1 (Existence of first). If N > 2 then there exists an integer 
first(N) G IN s.t. < first(N) < N and Vra G DM if < to < N then 
{first(N).a} < {to. a} 

Proof. 

By induction on N. 

- N — 2: in this case first(N) = 1. 

- Suppose the lemma to be holds for N: then there exists first(N) G DM s.t. 
< first(N) < N and Vto G DM if < to < TV then {/irst(iV).Q;} < {to.«}; 

let us show that there exists first(N + l) G DM s.t. < first(N+l) < N + l and 
VmGDMifO<TO<iV+l then {first(N + l).a} < {m.a}. 
By cases: 

- if {/irsi(AO.a) < {iV.a} then /irsi(7V + 1) = first(N). 

- if {/irst(iV).a} > {N.a} then first(N) = N. 

□ 

Lemma 2 (Existence of last). If N > 2 t/ien i/iere exists an integer 
last(N) G DM s.t. < last(N) < N and Vto G DM i/ < to < iV tfien 
{m.a} < {last(N).a} 

Proof. 

Symmetrical proof with respect to first. 

□ 

The successor of a point on the circle (after) verifies the following property: 

Lemma 3 (Property of points for after). VM gRi/0<M<1 then we 
have: 

either 

1. there exists an integer I G IN s.t. < I < N and M < {I. a} and Vto G DM 
ifO<m<N and if {to. a} > M then {to. a} > {I. a} 

or 

2. Vto G DM if < m < N then < {m.a} < M 
Proof. 

By induction on N. 

- N = 1: verifies the property. 

- Suppose lemma to holds for ./V and prove it for N+ 1: the induction hypothesis 
is the following: 

either 

1. there exists an integer I(N) G DM s.t. < I(N) < N and M < {I(N).a} and 



Vm 6 IN if < 77i < N and if {m.a} > M then {m.a} > {I(N).a} 
or 

2. Vm e IN if < 77i< N then < {m.a} < M 

We prove that : 

either 

1. there exists an integer I(N + 1) 6 DM s.t. < I(N + 1) < N + 1 and 
M < {I(N + l).a} and Vm e IN if < 777 < TV + 1 and if {m.a} > M then 
{m.a} > {I(N+l).a} 

or 

2. VmelNifO<m<7V + l then < {m.a} < M 
By cases: 

- if < M < {N.a} we are in case 1 and we continue by cases: 

- if {N.a} < {I(N).a} then I(N + 1) = N. 

- if {I(N).a} < {N.a} then I(N + 1) = I{N). 

- if {N.a} < M < 1 we are in case 2 and the proof is immediate by induction 
hypothesis. 

□ 

Definition 1 (after). For all points n on the circle, the point after(N,n) ver- 
ifies the property of points (lemma\$ for M — {77.0:} and is defined such that: 
if we are in case 1. then after(N,n) = I 
if we are in case 2. then after(N,n) = 0. 

2 Statement and proof of the theorem 

2.1 Statement 

Statement in natural language: 

Theorem 1 (Intuitive statement). Let N points be placed consecutively 
around the circle by an angle of a. Then for all irrational a and natural N , 
the points partition the circle into gaps of at most three different lengths. 

As shown by theorem^the points are numbered in order of apparition; now, 
if we do more than one revolution around the circle, new points appear between 
the former points. Then, when the last point (N — 1) is placed, it is possible to 
number them again consecutively and clockwise. In this new numeration, we use 
only the definitions of first, last and after, from lemmas ^ and El an d of the 
definition ^ 

If we set ||x||=mm({a;}, l — {x}), then the distance of a point 77 from its succes- 
sor after(N, n) is given by \\after(N, n) — n\\. In order to show that this function 
can have at most three values, we show that the function (after(N, n) — n) can 
itself have at most three values. 

So, proving theorem ^ comes to the same thing as showing the following 
mathematical formulation, which we will prove in the next paragraph. 



Theorem 2 (The three gap theorem). 



( first(N) if < m < TV - first(N) 

after(N,m) - m = < first(N) - last(N) if N - first(N) < m < last(N) 

[ -last(N) if last(N) < m< TV 

Remark 2. 



1. This transcription means that the circle of TV points is divided into 
TV — first gaps of length \\ first. a ||, 

TV — last gaps of length ||Zast.o || and 

first + last — TV gaps of length \\first.a \\ + \\last.a \\. 

2. Theorem |2 is true for a rational and irrational. Here, however, we present 
only the proof for a irrational. Indeed, most of the intermediate results are 
false for a rational (among other reasons because first, last and after are 
no longer functions). Moreover, the theorem is trivially true for a rational: 
if a = p/q then the circle may include one or two lengths of gap - depending 
on whether N < q or TV = q. 

2.2 Proof 

We recall that the proof is detailed for a irrational and TV > 2. 
Lemma 4 (particular case). If N = first(N) + last(N) 



after(N, m) — 




first(N) if < m < last(N) 
-last(N) if last(N) < m < TV 



Proof. 

1. Case < m < last(N): 

For m = 0, by definition of first we have after(N, 0) = first(N). 

We want to prove that m + first(N) is the successor of m. 

Let us first show that m + first(N) belongs to the circle of TV points: 

if < m < last(N) then 

< + first(N) <m + first(N) < last(N) + first(N) = TV. 

Now, let us show that: if i is any point of the circle (0 < i < TV) then 

we have either {i.a} < {m.a} or {i.a} > {(m + first(N)).a}. 

By reductio ad absurdum and by cases: 

let us suppose that {m.a} < {i.a} < {(m + first(N)).a} 



— if i > m then < {i.a} — {m.a} < {(m + first(N)).a} — {m.a} therefore 
< {(« — m).a} < {first(N).a} which contradicts the definition of first, 
since (i — to) € Circle because < i — in < N. 

— if i < to then {{m + first(N)).a} — {i.a} < {(m + first(N)).a} — {m.a} 
therefore {(to + first(N) — i).a} < {first(N).a} which contradicts 
the definition of first(N), since (to + first(N) — i) E Circle because 
< to + first(N) - i<N. 

In these two former cases {(m + first(N)).a} — {m.a} = {first(N).a} if 

{m.a} < {{m + first(N)).a}. 

Let us show this by reductio ad absurdum: 

if {(m + first(N)).a} < {m.a} then 

{(to + first{N)).a) - {first(N).a} < {m.a} - {first{N).a} 

therefore by definition of first {m.a} < {m.a} — {first(N).a} which is 

absurd because {first(N).a} > for N > 2. 

2. Case last(N) <m< N: 

For to = last(N), by definition of last we have after(N,last(N)) = 0. 

We want to prove that to — last(N) is the successor of to. 

Let us first show that to — last(N) belongs to the circle of N points: 

if last(N) < to < N then 

< last(N) - last(N) < to - last(N) < N - last(N) < N because 
last(N) > 0. 

Now, let us show that: if i any point of the circle (0 < i < N) then we 

have either {i.a} < {m.a} or {i.a} > {(to — last(N)).a}. 

By reductio ad absurdum and by cases: 

let us suppose that {m.a} < {i.a} < {(to — last(N)).a} 

— if i < to then {to. a} — {i.a} + 1 > {m.a} — {(to — last(N)).a} + 1 
therefore {(to — i).a} > {last(N).a} which contradicts the definition of 
last, since (to — i) e Circle because < to — i < N. 

— if to < i then 

{m.a} - {(to - last(N)).a} + 1 < {i.a} - {(to - last(N)).a} + 1 
therefore {last(N).a} < {(i + m - last(N)).a} 

which contradicts the definition of last, since (i + to — last(N)) e Circle 
because < i + to — last(N) < N. 

In these two former cases {m.a} — {(to — last(N)).a} + 1 = {last(N).a} if 
{m.a} < {(to - last(N)).a}. 

As a is irrationnal and by definition of last we have {m.a} < {last(N) .a} 
therefore {(to — last(N)).a} — {m.a} — {last(N).a} + 1 and we have effec- 
tively {m.a} < {m.a} — {last(N).a} + 1, since {last(N).a} < 1. 



Remark 3. The fact of a is irrational is essential for showing that 
{to. a} y£ {last(N).a}. Indeed, as in this case we have to ^ last(N) therefore 
{to. a} ^ {last(N).a}. Let us show this by contradiction. 
In order to do so, let us suppose {to. a} = {last(N) .a} . 

Then {to. a} — {last(N).a} = therefore {(to — last(N)).a} — and as only an 
integer number has a fractional part equal to zero we have (to — last(N)).a — k, 

k 6 IN from which we conclude that a — , fc f n which contradicts a irra- 

tionnal. 

□ 

Let us prove now the general case. 

Let us set for the rest of the proof M = first(N) + last(N). 
Lemma 5 (Relationship between N and M). N < M. 

Proof. 

By reductio ad absurdum. We suppose M < N and we show that, in this case, 
the point first(N) + last(N) is situated either before first, or after last, which 
contradicts their definition. 

Let us show, therefore, that either {(first(N) + last(N)).a} < {first(N).a} or 
{{first(N) + last(N)).a} > {last(N).a}: 
Let us consider the following cases: 

1. {first(N).a} + {last(N).a} < 1: 

since for TV > 2 {first(N).a} > we can write that 
{first(N).a} + {last(N).a} > {last(N).a} thus that 
{{first(N) + last(N)).a} > {last(N).a}. 

2. {first(N).a} + {last(N).a} > 1: 

in the same way we can write, using the fact that < {} < 1, that 
{first(N).a} + {last(N).aj - 1 < {first(N).a} thus that 
{(first(N) + last{N)).a} < {first(N).a}. 

□ 

Lemma 6. first(N) — first(M). 
Proof. 

By definition of first, we know that for all a and b s.t. < a < N and < b < N 
we have that if {a. a} < {b. a} then a = (first(N)). 

Let us take N — M and a = (first(N)) and then we have for all b s.t. < b < M 
if {{first(N)).a} < {b.a} then (first(N)) = {first(M)). 
Now, it is sufficient to show that {{first(N)).a} < {b.a} Mb, < b < M: 
For < b < N it is the definition of first (lemma ^1. 

For N < b < M by the reductio ad absurdum: let us suppose that 
{b.a} < {{first(N)).a} 

As b < M = first(N) + last(N) we have immediately that 
b - first{N) < last(N) < N and b - last(N) < first{N) < N 



and by definition of first and last that {(b — first(N)).a} < {last(N).a} and 
{first(N).a} < {{b-last(N)).a}. 

Therefore we have, owing to the hypothesis of contradiction and to lemmas ^ 
and |21 that: 

{b.a} - {first(N).a} + 1 < {last{N).a} and 
{first{N).a} < {b.a} — {last(N).a} + 1 which implies that 
{last{N).a} + {first(N).a} - {b.a} -1 = thus that 

{(b — first(N)).a} = {last(N).a}. But, as shown in Remark [31 this equality 
compels a to be rational if b — first(N) ^ last(N) which is the case. 

□ 

Lemma 7. last(N) = last(M). 
Proof. 

Symmetrical proof with the previous. 

□ 

Lemma 8. For all n s.t. < n < N — first(N) and last(N) < n < N we have 
after(N, n) = after(M, n). 

Proof. 

We proceed by cases: 

1. Case < n < N - first(N): 

Using the irrationality of a (counterpart of remark we have that to prove 
this lemma is equivalent to {after(N, n).a} — {after(M, n).a} which is also 
equivalent to 

{after(N, n).a} < {after(M,n).a} and {after (M,n). a} < {after(N,n).a}. 
Let us proceed by cases and by reductio ad absurdum: 

— Case {after(N, n).a} < {after{M,n).a}\ 

Let us suppose that {after(N, n).a} > {after(M,n).a}. 

According to lemma |3 we show immediately the following property: 

VW £ DM, Vn, k £ Circle, if {n.a} < {k.a} and if {k.a} ^ {after(N, n).a} 

then {after(N, n).a} < {k.a}. Let us use this property with 

k = after(M,n). We directly get the contradiction on condition that : 

• n 6 Circle i.e. < n < N; true by case 1. 

• after(M,n) £ Circle i.e. < after(M,n) < N true using lemma^J 

• {n.a} < {after(M,n).a} by definition of after (lemma[3]and defini- 
tional + lemmaQ](in order to show that after(M,n) ^ 0). 

• {after(M, n).a} ^ {after(N, n).a} true by hypothesis of contradic- 
tion. 

— Case {after(M, n).a} < {after(N,n).a}: 

Let us suppose that {after(M 7 n).a} > {after(N, n).a}. We use the 
same property taking k = after{N, n) and N = M (except in k). 

2. Case last(N) < n < N: the proof is done with the same way. 



□ 



For n situated in the third gap, the value of after(N, n) is given from the 
following lemma : 

Lemma 9. For all n, N — first(N) < n < last(N) there does not exist 
k G Circle s.t. {n.a} < {k.a} < {(n + first(N) - last(N)).a}. 

Proof. 

Reduction ad absurdum. 

Let us suppose there exists one k G Circle s.t. 
{n.a} < {k.a} < {(n + first(N) - last(N)).a}. 

This k verifies one of the three following cases (total order on the real numbers): 

1. if {k.a} < {after(M.n).a}: 

then {n.a} < {k.a} < {after(M.n).a} which contradicts the definition of 
the function after. 

2. if {k.a} = {after(M.n).a}: 

according to lemmas U and [B] after(M, n) = n + first(N). But, as a is 
irrationnal, we ought to have k = n + first(N) which contradicts the hy- 
pothesises n < last(N) and k < N (using lemma [5jl. 

3. if {k.a} > {after(M.n).a}: 

we use the already seen property VW G IN, Vj, k G Circle, if {j.a} < {k.a} 
and if {k.a} {after(N,j).a} then {after(N, j).a} < {k.a} with N = M, 
j = n + first(N). 

Then we have, using principally lemma 0] that 

{(ri + first(N) ~ last(N)) .a} < {k.a} which contradicts the hypothesis. 

□ 

Proof of theorem |21 

Let us suppose that the circle includes M points. Then, we know how to 
show the theorem (lemma0J). Now, It is sufficient "to remove" the M — N points 
which are too many. 

1. if < n < N - first(N) then: 

according to lemma we have < n < N — first(N) < last(N). Using 
lemmas El [7| IH1 an d El we immediately get the result. 

2. if N - first(N) <n< last(N) then: 

using lemma we show that the M — N points from N do not exist and by 
definition of after (lemma |31 and definition ^) we get the result. 

3. if last < n < N then: 
as in case 1. 

□ 

Conclusion 

The proof given in this paper has been developped from a proof completely 
formalized in the system Coq |BB+97| . 



The advantages of a formal proof 

With a mathematical theorem such as this, the interest is twofold: the first 
consists in indicating the possible limits of the proof assistance system in order 
to improve it; second, is the emphasizing the basic mathematical properties or 
hypotheses used implicitly during the demonstration. 

This proof is based on geometrical intuitions and the demostration of these 
intuitions often requires, for example, basic notions about the fractional parts. 
Even so, these notions are neither easy to formalize nor to prove in a system 
where real numbers are not naturally found, unlike other types which can be 
easily defined inductively. So, one challenge was to prove this theorem from a 
simple axiomatization of the real numbers. The formulation of real numbers used 
for this will be discussed further. 

Throughout this work, we confirmed that the Coq proof assistant system 
allows us to work out some purely mathematical proofs. For more details, see 
|MAY99| . 

Moreover, it is interesting to notice that the theorem shown is, in some sence, 
stronger than that which was stated initially. Indeed, not only do we show that 
there are at most three different lengths of gaps, but we can also give their value 
and their place on the circle. This modified statement is due to [R"AV88 . 

From the proof completely formalized in Coq, we can, for instance, compare 
this informal proof resulting from the formal proof with that of Tony van Raven- 
stein. 



Properties about K 

— Two possibilities exist to describe the real numbers: we can construct the 
reals or axiomatize them. We chose an axiomatical development for reasons 
of simplicity and rapidity. We can refer to LA N71j and [LAN 51 for con- 
structions from Cauchy's sequences or Dedekind's cuts. Most properties of 
the real numbers (commutative field, order, the Archimedian axiom) are first 
order properties. On the other hand, the completeness property is a second 
order property, as it requieres to quantify on the sets of real numbers. In- 
stead of this axiom, we can put an infinity of first order axioms, according to 
which any odd degree has a root in R. Hence, we get the "real closed field" 
notion. We thus chose axiomatization at the second order based on the fact 
that R is a commutative ordered Archimedian and complete field. 
For these notions, we based our work on |D1E68| and |HAR96| . 

— The formal proof showed us that the axiom of completeness of the real 
numbers was not necessary. Therefore, the statement and the proof of this 
theorem are true in all the commutative ordered and Archimedean fields. 
Archimedes' axiom could also be replaced by a weaker axiom making it 
possible to define only the fractional part. 

In the same way, E. Fried and V.T.Sos have given a generalization of this 
theorem for groups IFR+921 . 



The fractional parts. 

Many intermediate lemmas had to be proved. The formal proof, for instance, 
made it possible to identify four lemmas concerning the fractional part, which 
had remained implicit in Tony van Ravenstein's proof, and are at the heart of 
the proof. 

- if {rl} + {r2} > 1 then {rl + r2} = {rl} + {r2} - 1 

- if {rl} + {r2} < 1 then {rl + r2} = {rl} + {r2} 

- if {rl} > {r2} then {rl - r2} = {rl} - {r2} 

- if {rl} < {r2} then {rl - r2} = {rl} - {r2} + 1 

Degenerated cases. 

The formal proof makes it possible to separate the degenerated cases such 
that N = 0, N = 1 and a rational, which can be passed over in silence during 
an informal proof. 

a irrational. 

a irrational is hypothesis used by Tony van Ravenstein, but the formalization 
shows precisely where this hypothesis is used (cf remark |3J. In particular, if a 
is rational, the points can be mingled, and after, for example, is not then a 
function. 

first (N) and first (M), last, after. 

During Tony van Ravenstein's informal proof, we see that we can tolerate an 
inaccuracy in the dependence of first, last and after to N or M. Although this 
is not a mistake, the formal proof showed the necessity of proving these lemmas, 
which are not trivial (lemmas El \7\ and [SJ. The formal proof makes it possible to 
say precisely where those lemmas are used. 

Use of the classical logic. 

The formal proof carried out in the system Coq - from the axiomatization of 
real numbers as a commutative, ordered, archimedian and complet field - is a 
classical proof seeing that an intuitionist reading of the total order involves the 
decidability of the equality of the real numbers, which obviously, is not the case. 
Therefore, we can raise the question of the existence of a constructive proof of 
the three gap theorem. 

We could probably give an intuitionistic proof for each of the two cases, accord- 
ing to whether a is rational or irrational because we know exactly the length of 
the gaps between two points of the circle. But, the two cases cannot be treated 
at the same time. Thus in our proof it should be supposed that a is rational or 
not and we do not see, so far how to avoid this distinction. 
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